Resubmissions

06-12-2022 06:15

221206-gzxv7sbc77 3

02-12-2022 17:00

221202-vjcrzsbc51 10

Analysis

  • max time kernel
    144s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2022 17:00

General

  • Target

    respondents/suspect.cmd

  • Size

    283B

  • MD5

    99838a4fa2fbb0955a78f3fe97212626

  • SHA1

    32a16917424cf9f98ffac8737b8293d268c27aec

  • SHA256

    6ce73c1af6962cd08164173eeab0c367c069c2d0a583ef7f92ddbf3ef3a5bfa9

  • SHA512

    1317ab6f713d897c5f4a445ee476440fe3140b13cc6f40fee4cdbe3f1d6d04c14c7f0ef8f2e83bdecacac1a54e55e87a1ee7547dae49520439379fd99a5215a7

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\respondents\suspect.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3468
    • C:\Windows\system32\replace.exe
      replace C:\Windows\\32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
      2⤵
        PID:3452

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3452-132-0x0000000000000000-mapping.dmp